Hardcoded GitHub OAuth Credentials

[Hackmeritik]

Description

GitHub OAuth client_secret is hardcoded in extension source code, exposed publicly in repository.

Vulnerable Code

// js/github.js (lines 6-7)
const client_id = 'e099a4803bb1e2e773a3';
const client_secret = '81fbfc45c65af8c0fbf2b4dae6f23f22e656cfb8';

Impact

Exposed GitHub OAuth credentials with Gist permissions
Potential unauthorized access to user playlist backups
Attacker could impersonate legitimate OAuth flow

Proof of Concept

git clone https://github.com/listen1/listen1_chrome_extension.git
grep -n "client_secret" listen1_chrome_extension/js/github.js
# Output: 7:const client_secret = '81fbfc45c65af8c0fbf2b4dae6f23f22e656cfb8';

Remediation

1.Remove hardcoded credentials
2.Implement server-side OAuth proxy OR use Chrome Identity API
3.Rotate compromised credentials immediately

// Use Chrome Identity API instead
chrome.identity.launchWebAuthFlow({
  url: oauthUrl,
  interactive: true
}, function(accessToken) { /* handle token */ });

References

CWE-798: Use of Hard-coded Credentials
GitHub Security Advisories